release.yml

name: Release

on:
  push:
    tags:
      - "v*"

permissions:
  contents: read

concurrency:
  group: release-${{ github.ref }}
  cancel-in-progress: false

jobs:
  build:
    name: Build, sign, notarize, and publish
    runs-on: macos-26
    environment: release
    permissions:
      actions: write # Required to dispatch checks for the generated metadata pull request.
      contents: write # Required to create the GitHub Release and push its metadata branch.
      pull-requests: write # Required to open the release metadata pull request.

    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          persist-credentials: false

      - name: Get version
        id: version
        run: echo "version=${GITHUB_REF#refs/tags/v}" >> "$GITHUB_OUTPUT"

      - name: Import code signing certificate
        env:
          CERTIFICATE_P12: ${{ secrets.CERTIFICATE_P12 }}
          CERTIFICATE_PASSWORD: ${{ secrets.CERTIFICATE_PASSWORD }}
        run: |
          KEYCHAIN_PATH="$RUNNER_TEMP/app-signing.keychain-db"
          KEYCHAIN_PASSWORD="$(openssl rand -base64 32)"
          security create-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
          security set-keychain-settings -lut 21600 "$KEYCHAIN_PATH"
          security unlock-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"

          echo "$CERTIFICATE_P12" | base64 --decode > "$RUNNER_TEMP/certificate.p12"
          security import "$RUNNER_TEMP/certificate.p12" -P "$CERTIFICATE_PASSWORD" -A -t cert -f pkcs12 -k "$KEYCHAIN_PATH"
          security set-key-partition-list -S apple-tool:,apple: -k "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
          security list-keychain -d user -s "$KEYCHAIN_PATH"

          curl -sL https://www.apple.com/certificateauthority/DeveloperIDG2CA.cer -o "$RUNNER_TEMP/DeveloperIDG2CA.cer"
          security import "$RUNNER_TEMP/DeveloperIDG2CA.cer" -k "$KEYCHAIN_PATH" || true

      - name: Build and notarize
        env:
          SIGNING_IDENTITY: ${{ secrets.SIGNING_IDENTITY }}
          APP_STORE_CONNECT_KEY: ${{ secrets.APP_STORE_CONNECT_KEY }}
          APP_STORE_CONNECT_KEY_ID: ${{ secrets.APP_STORE_CONNECT_KEY_ID }}
          APP_STORE_CONNECT_ISSUER_ID: ${{ secrets.APP_STORE_CONNECT_ISSUER_ID }}
        run: ./build-app.sh --release --notarize

      - name: Create zip
        run: ditto -c -k --keepParent "ClickLight.app" ClickLight.zip

      - name: Download Sparkle tools
        run: |
          curl -L -o /tmp/sparkle.tar.xz "https://github.com/sparkle-project/Sparkle/releases/download/2.9.2/Sparkle-2.9.2.tar.xz"
          cd /tmp && tar xf sparkle.tar.xz

      - name: Sign Sparkle update
        id: sparkle
        env:
          SPARKLE_PRIVATE_KEY: ${{ secrets.SPARKLE_PRIVATE_KEY }}
        run: |
          echo "$SPARKLE_PRIVATE_KEY" > /tmp/sparkle_key
          OUTPUT=$(/tmp/bin/sign_update ClickLight.zip -f /tmp/sparkle_key)
          SIGNATURE=$(echo "$OUTPUT" | sed -n 's/.*sparkle:edSignature="\([^"]*\)".*/\1/p')
          LENGTH=$(echo "$OUTPUT" | sed -n 's/.*length="\([^"]*\)".*/\1/p')
          echo "signature=$SIGNATURE" >> "$GITHUB_OUTPUT"
          echo "length=$LENGTH" >> "$GITHUB_OUTPUT"
          rm /tmp/sparkle_key

      - name: Update Homebrew cask
        env:
          VERSION: ${{ steps.version.outputs.version }}
        run: |
          SHA=$(shasum -a 256 ClickLight.zip | awk '{print $1}')
          sed -i '' "s/version \".*\"/version \"$VERSION\"/" Casks/clicklight.rb
          sed -i '' "s/sha256 \".*\"/sha256 \"$SHA\"/" Casks/clicklight.rb

      - name: Update appcast
        env:
          VERSION: ${{ steps.version.outputs.version }}
          SIGNATURE: ${{ steps.sparkle.outputs.signature }}
          LENGTH: ${{ steps.sparkle.outputs.length }}
        run: |
          DATE=$(date -u +"%a, %d %b %Y %H:%M:%S +0000")
          cat > appcast.xml << EOF
          <?xml version="1.0" encoding="utf-8"?>
          <rss version="2.0" xmlns:sparkle="http://www.andymatuschak.org/xml-namespaces/sparkle">
            <channel>
              <title>ClickLight</title>
              <item>
                <title>Version ${VERSION}</title>
                <sparkle:version>${VERSION}</sparkle:version>
                <sparkle:shortVersionString>${VERSION}</sparkle:shortVersionString>
                <pubDate>${DATE}</pubDate>
                <enclosure url="https://github.com/aurorascharff/ClickLight/releases/download/v${VERSION}/ClickLight.zip"
                           type="application/octet-stream"
                           length="${LENGTH}"
                           sparkle:edSignature="${SIGNATURE}"/>
              </item>
            </channel>
          </rss>
          EOF

      - name: Create release
        env:
          GH_TOKEN: ${{ github.token }}
          VERSION: ${{ steps.version.outputs.version }}
        run: gh release create "v${VERSION}" ClickLight.zip --generate-notes

      - name: Open release metadata pull request
        env:
          GH_TOKEN: ${{ github.token }}
          VERSION: ${{ steps.version.outputs.version }}
        run: |
          BRANCH="release/v${VERSION}-metadata"
          cp Casks/clicklight.rb "$RUNNER_TEMP/clicklight.rb"
          cp appcast.xml "$RUNNER_TEMP/appcast.xml"

          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"
          AUTH_HEADER=$(printf "x-access-token:%s" "$GH_TOKEN" | base64 | tr -d '\n')
          git restore Casks/clicklight.rb appcast.xml
          git -c "http.https://github.com/.extraheader=AUTHORIZATION: basic ${AUTH_HEADER}" fetch origin main
          git switch -c "$BRANCH" origin/main
          cp "$RUNNER_TEMP/clicklight.rb" Casks/clicklight.rb
          cp "$RUNNER_TEMP/appcast.xml" appcast.xml
          git add Casks/clicklight.rb appcast.xml
          git commit -m "Update release metadata for v${VERSION}"
          git -c "http.https://github.com/.extraheader=AUTHORIZATION: basic ${AUTH_HEADER}" push origin "$BRANCH"
          gh pr create \
            --base main \
            --head "$BRANCH" \
            --title "Update release metadata for v${VERSION}" \
            --body "Updates the Homebrew cask and Sparkle appcast for the published v${VERSION} release. Merge this PR to make the release available through Homebrew upgrades and in-app updates."
          gh workflow run security.yml --ref "$BRANCH"
          gh workflow run pr-smoke.yml --ref "$BRANCH"